A distributed network system typically includes various computer nodes interconnected by a communications medium. The computer nodes may include nodes that are directly accessed by users, e.g., workstations, and nodes running specialized applications, e.g., servers. These nodes, the applications running on these nodes, and the users of the distributed system may be referred to as "principals." The methodology employed to reliably verify the identity of a user of a distributed network system prior to allowing the user access to system resources and applications is referred to as authentication. Authentication is generally performed on behalf of the principals.
In a typical distributed network system, the user sends a password to each application running on a remote node in order to access its resources. If the password for each application is different, remembering the password and its associated application may be rather difficult and unpleasant. The user could simply set each password for each application to the same value, but this presents the problem that if the user changes one password and forgets to change the others, the passwords will diverge.
On the other hand if the user has the same password for all applications, the local application with which the user "logs-in" typically saves the entered password and automatically sends it to remote applications as needed. This type of remote authentication is susceptible to a password-based system threat known as eavesdropping, i.e., interception of the password by wiretapping the network. To counter such a threat, cryptography is often used to preserve the confidentiality of the transmitted password when authenticating the user to remote applications.
A well-known cryptographic technique used to perform remote authentication is public key cryptography. In this method of secure communication, each principal has a public encryption key and a private encryption key, and two principals can communicate knowing only each other's public keys and, of course, their own private keys. An encryption key is a code or number which, when taken together with an encryption algorithm, defines a unique transformation used to encrypt or decrypt data. A public key system may be used in such a way as to ensure that information being transmitted cannot be understood by an eavesdropper, as well as to ensure the authenticity of the sender of the information.
The manner in which a public key cryptography system operates to ensure authentication may be understood without reference to the mathematical transformations that are used for encryption and decryption. Public key cryptography is also referred to as "asymmetric" encryption because information encoded with a public key may be decoded only by using a complementary private key, the associated public and private keys defining a key pair. According to this type of encryption, the private key is known only to the owner of the key, while the public key is known to other principals in the system.
Accordingly, to effect a secure transmission of information to a recipient, a principal encodes ("encrypts") the information with the recipient's public key. Since only the intended recipient has the complementary private key, only that principal can decode ("decrypt") it. On the other hand, to prove to a recipient of information that the sender is who he purports to be, the sender encodes ("signs") the information with its private key. If the recipient can decode ("verify") the information, it knows that the sender has correctly identified itself. In public key cryptography, each principal is responsible for knowing its own private key and all the public keys are generally accessible from one location, typically a directory service (DS).
Operation of a public key cryptography system will now be described with reference to an illustrative login authentication exchange between a workstation, acting on behalf of a user, and a remote server. Basically, the workstation encrypts a message for confidentiality by performing a transformation using the server's public key, and a server decrypts the message by performing a transformation using its private key.
A user logs into the workstation with the user's password and the workstation derives a secret encryption key by applying a known hash algorithm to the password prior to deleting it. The workstation then requests the user's private key from a DS of the remote server. The user's private key has previously been encrypted under the same secret encryption key and stored as a credential of the directory. A credential is a table entry comprising the user's name and the user's private key; in other words the credential is a representation of the user in the computer. The remote server returns the encrypted private key to the workstation, which uses the secret key to decrypt and obtain the private key.
By demonstrating possession of the private key, the workstation may thereafter attempt to access distributed system-based services or applications on behalf of the user. For example, the user may attempt to log into a different workstation or server, attempt to access a different operating system or attempt to access applications such as Lotus Notes or Novell GroupWise. Each of these entities typically includes a component referred to as an authentication agent that maintains the user's identity and secret (e.g., password). Although the user has been generally authenticated on the network, these agents may not be aware of that authentication, and thus query the user for a password. This can consume considerable bandwidth and can be quite intrusive to the user, particularly in systems requiring users to be authenticated whenever a resource is accessed.
A known mechanism for solving this problem is a single sign-on mechanism. Here, a main application stores the secrets of the other applications and, in response to an inquiry from an application, provides the appropriate secret on behalf of the user. The user thus does not have to retype the secrets, as it is assumed that if the user has successfully logged into the main application, the workstation can access the secrets of the other applications and provide them to the applications on behalf of the user.
Specifically, a group of encrypted application secrets are associated with the user; this group of secrets is referred to as a "keychain". The keychain is assigned a public/private key pair, wherein all of the secrets of the keychain are encrypted with the public key and the private key for the keychain is encrypted with the user's password. When the user logs into the main application with its password, this password is used to decrypt the user's private keychain key. The workstation then forgets the password but keeps the private keychain key accessible. The encrypted application-specific secrets are decryptable with the private keychain key. An application-specific secret may therafter be retrieved from the keychain and decrypted with the private keychain key.
Notably for security reasons, the password used for logging into the main application is not retained at the workstation, primarily because malicious software could capture the password and use it to impersonate the user. When implemented in a straightforward way, however, the single sign-on mechanism precludes periodic quizzing of the user for a password. But there are instances, such as after a period of no activity from the user, when it may be useful to quiz the user for its password to ensure that it is indeed still the user.
One approach to inquirying as to the user's identity involves repeating the illustrative login exchange whenever the user is required to type a password. This is undesirable because the exchange typically involves communication with another computer (e.g., the DS server) and that server might be unavailable when attempting to verify the user's password. Another option is to assign an application the responsibility of quizzing the user for a password and further assign the application its own version of the password. This approach is also undesirable because if the user changes its main password, the two passwords will be different.
The present invention avoids the disadvantages associated with these prior approaches and is directed to a technique for dynamically authenticating a user to various services and applications in a distributed network system.